CVE-2023-22647: 
Rancher vulnerability analysis and mitigation

An Improper Privilege Management vulnerability (CVE-2023-22647) was discovered in SUSE Rancher affecting versions from 2.6.0 to 2.6.13 and 2.7.0 to 2.7.4. The vulnerability was disclosed on June 1, 2023, and received a CVSS v3.1 score of 9.9 (Critical) (Rancher Advisory).

The vulnerability allows standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster (where Rancher is installed). When a secret is deleted, the user's read-level permissions to the secret are preserved. This operation, when combined with specially crafted commands, enables access to tokens belonging to service accounts in the local cluster. Users with custom global roles having create and delete permissions on secrets are particularly vulnerable to this exploit (Security Online, NVD).

The vulnerability enables standard users or users with higher privileges to elevate their permissions to Administrator level in the local cluster. This could lead to unauthorized access to sensitive information, manipulation of cluster resources, and potential compromise of the entire Rancher management system (Rancher Advisory).

The vulnerability has been patched in Rancher versions 2.6.13 and 2.7.4. There is no direct mitigation method other than updating to these patched versions. After patching, it is recommended to review all access methods to Rancher, including RBAC policies, tokens, and host-level node access, to ensure no unauthorized changes were made (Rancher Advisory).